US7327847B2 - Method for distributed computation of RSA inverses in asynchronous networks - Google Patents
Method for distributed computation of RSA inverses in asynchronous networks Download PDFInfo
- Publication number
- US7327847B2 US7327847B2 US10/768,933 US76893304A US7327847B2 US 7327847 B2 US7327847 B2 US 7327847B2 US 76893304 A US76893304 A US 76893304A US 7327847 B2 US7327847 B2 US 7327847B2
- Authority
- US
- United States
- Prior art keywords
- value
- share
- rsa
- inverse
- values
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related, expires
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L9/3006—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters
- H04L9/302—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
Definitions
- the present invention is related to a method and system for distributed computation of an RSA inverse value in an asynchronous network among participating network devices.
- RSA is the most widely used public-key cryptographic system today and uses an algorithm developed in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman. Methods for sharing an RSA key among a group of parties in a distributed system, and for using the key in a fault-tolerant way have therefore received considerable attention. They are the subject of threshold cryptography.
- the disclosed scheme is attractive because it does not rely on Byzantine agreement; it leads to efficient asynchronous protocols for threshold signatures and for Byzantine agreement based on the strong RSA assumption, without the use of random oracles.
- the random oracle model allows to design practical cryptographic systems, but only yields heuristic evidence for their security.
- Using the scheme one can obtain asynchronous threshold implementations of the RSA signature schemes which are based on the strong RSA assumption. These represent the first implementations of threshold signatures in asynchronous networks without random oracles.
- the disclosed scheme for asynchronous distributed RSA inversion is quite practical, achieves resilience n>4t, and uses O (n 3 ) messages and O (n 3 K 2 ) communication, where K is a security parameter. Moreover, it is deterministic and does not rely on a randomized Byzantine agreement primitive, which would not only be more expensive but also preclude one of its applications: to implement randomized asynchronous Byzantine agreement using cryptography.
- the scheme employs one distributed multiplication step like the synchronous RSA inversion protocol of Catalano et al.
- the disclosed scheme does not need Byzantine agreement because RSA inversion is self-verifiable and the result can be checked by every participant, i.e. participating network device, locally.
- a method for distributed computation of an RSA inverse value y in an asynchronous network from at least two input values x, e among n ⁇ 1 participating network devices A, B, C comprising t ⁇ n/4 faulty devices and a non-faulty leader device D, the participating network devices A, B, C, D holding share values ⁇ A , ⁇ B , ⁇ C , ⁇ D of the Euler function ⁇ (N) of an RSA modulus N, each participating network device, with P A, B, C, D performing the steps of:
- Each participating network device A, B, C, D can perform the following steps.
- the validity of the obtained RSA inverse value y under use of the at least two input values x, e can be determined, and in the event of positive determination, the RSA inverse value y is broadcast and further calculations are stopped. This allows an efficient execution of the method while a termination can be guaranteed.
- the sharing over integers can use a threshold signature for determining the consistency of subsequently received sub-share values q i , r i , 0 i allows a faster termination of the scheme.
- the sharing over integers can use a vector of digital signatures for determining the consistency of subsequently received sub-share values q i , r i , 0 i which also allows a faster termination of the scheme.
- the Extended Euclidean Algorithm can be applied for deriving the exponent share value d P , which from the practical point of view is efficient.
- the RSA inverse value y can be obtained from the received inverse-share value y i by using the Lagrange Interpolation Algorithm, which is efficient.
- FIG. 1 shows a typical asynchronous network with multiple participating network devices and a distributor.
- FIG. 2 shows a flow diagram for distributed computation of an RSA inverse value y in an asynchronous network.
- FIG. 3 shows a flow diagram with steps which each participating network device can perform when t+1 participating network devices act as a leader device.
- the system comprises here a dealer device D, which is designated by the “X”.
- t+1 participating network devices may act as a leader device, as described in more detail below.
- Each participating network device A, B, C, D may be any type of computer device known in the art from a computer on a chip or a wearable computer to a large computer system.
- the communication lines can be any communication means commonly known to transmit data or messages from one participating network device A, B, C, D to another.
- the communication lines may be either single, bi-directional communication lines 5 between each pair of participating network devices A, B, C, D or one unidirectional line in each direction between each pair of participating network devices A, B, C, D.
- a computer system 8 and communication lines 5 are well known in the art.
- one participating network device A, B, C sends information to itself
- an equivalent result could be achieved by merely moving data within the participating network device and not sending it over a communication line to itself.
- the common computer system 8 is shown to facilitate the description of the following distributed RSA inverse computation protocol.
- the same reference signs are used to denote the same or like parts.
- a method for distributed computation of an RSA inverse value y in an asynchronous network is described in the following together with some basic and further issues.
- FIG. 2 shows a flow diagram of a method 20 for distributed computation of an RSA inverse value y in an asynchronous network, from at least two input values x, e among n ⁇ 1 participating network devices A, B, C comprising t ⁇ n/4 faulty devices and a non-faulty leader device D.
- the participating network devices A, B, C, D hold share values ⁇ A , ⁇ B , ⁇ C , ⁇ D of the Euler function ⁇ (N) of an RSA modulus N.
- the two input values x, e, the RSA modulus N, and the share values ⁇ P are acquainted, as indicated in boxes 2 and 3 , respectively.
- Each participating network device performs the following steps referenced with Roman numbers.
- a first random value q and a second random value r are chosen, as indicated by box I.
- the first random value q, the second random value r, and the zero value 0 are shared over integers , as indicated with box II.
- the leader device D additionally receives a first, second, and third sub-share value q i , r i , 0 i from the at least t+1 participating network devices A, B, C, D and broadcasts the identities S of the participating network devices A, B, C, D, as indicated by the boxes IIIi and IIIii.
- a receiving step the identities S and corresponding sub-share values q i , r i , 0 i are received as indicated with box IV.
- a sum-share value F can be derived from the share value ⁇ P , the input value e, and the corresponding sub-share values q i , r i , 0 i defined by the identities S, as indicated with box V.
- the sum-share value F is then broadcast, as indicated with box VI, whereby such a broadcast does not guarantee anything if the respective sender is faulty.
- 2t+1 sum-share values F i are received, as indicated with box VII.
- a polynomial ⁇ is derived, as indicated with box VIII, which interpolates the sum-share values F i and an exponent share value d P dependent on the polynomial ⁇ , and an inverse-share value y P dependent on the exponent share value d P and the RSA modulus N.
- the inverse-share value y P is then broadcast, as indicated with box IX, and t+1 inverse-share value y i are received as indicated with box X.
- the RSA inverse value y can be obtained from the received inverse-share value y i , as indicated with box XI.
- the knowledge of ⁇ (N) is equivalent to knowing the factorization of N. In the following it is shown how to compute this in an asynchronous distributed network where ⁇ (N) is shared among the participating network devices A, B, C, D, hereafter also referred to as parties or P 1 , P 2 , . . . , P n , or each as party or P i , or P l .
- a (n, k)-sharing of a secret ⁇ is an encoding of s into a set of shares ⁇ A , ⁇ B , ⁇ C , ⁇ D such that any set of at least k shares uniquely defines ⁇ and any set of less than k shares does not give information about ⁇ .
- Associated with a sharing is an efficient reconstruction algorithm that reconstructs ⁇ from any set of k shares.
- N is an RSA modulus.
- the participating network devices A, B, C, D hold the shares of a (n, k)-sharing, as described in the previous paragraph, of the corresponding RSA secret key ⁇ (N).
- the method 20 is hereafter also referred to as preliminary protocol 20 , as there are messages sent forth and back between the parties. More precisely, the preliminary protocol 20 is an RSA inversion protocol with non-faulty leader device.
- the preliminary protocol 20 for RSA inversion of x and e, for some e>n, is started with input values e, N, x, ⁇ P .
- One party terminates the protocol by generating an output value y. All non-faulty parties should be activated like this and all should output y such that y e ⁇ x (mod N).
- AVSS asynchronous verifiable secret sharing
- the AVSS protocol is used many times as sub-protocol within the herein described RSA inversion protocol.
- Dual-threshold sharings are considered in this paragraph, which generalize the standard notion of secret sharing by allowing the reconstruction threshold to exceed the number of corrupted parties by more than one.
- an (n, k, t) dual-threshold sharing there are n parties holding shares of a secret, of which up to t may be corrupted by an adversary, and any group of k or more honest parties may reconstruct the secret (n ⁇ t ⁇ k>t).
- Such dual-threshold sharings are useful for distributed computation and agreement problems.
- Polynomial secret sharing is usually done in a finite field, but it works also over , provided that extra randomization is added. This is a well-known technique developed in the context of threshold RSA.
- Let L n!.
- Denote the coefficients of the sharing polynomial ⁇ by ⁇ 0 , ⁇ 1 , . . . , ⁇ k ⁇ 1 ; they are divisible by L and their absolute value is bounded by KL 3 M.
- a protocol for weak AVSS comprises a secret sharing method with verification over the integers to achieve robustness based on the strong RSA assumption in N .
- K be a security parameter
- N a safe RSA modulus
- g and h two random squares in * N and s ⁇ [0, M ⁇ 1] the secret to share.
- n, m, t non-interactive
- the dealer sends a share of the secret to all parties and every party answers with a threshold signature share if the share is valid.
- the dealer computes the threshold signature and sends it to all parties.
- a party accepts the sharing when it has a valid share and receives a valid threshold signature.
- the preliminary protocol 20 is contemplated to work with a correct leader. It tolerates crashes and a passive adversary. That is, all parties apart from the leader may crash and collude to gain knowledge about the secret, but otherwise they follow the protocol.
- the preliminary protocol 20 is hereafter described more mathematically.
- the parties first compute a K-random (n, t+1, t)-sharing of a random Q 0 ⁇ [0, KN ⁇ 1], an analogous sharing of a random R 0 ⁇ [0, K 2 N 2 ⁇ 1], and a K-random (n, 2t+1, t)-sharing of 0 ⁇ [0, K 4 L 3 N 2 ⁇ 1].
- These sharings are executed in parallel as mentioned above in the protocol to share multiple secrets and define integer polynomials Q(z) and R(z) of degree t and H(z) of degree 2t.
- the shares of P i are Q(i), R(i), and H(i).
- d aL 2 R 0 +b is the inverse of e modulo ⁇ , as is easy to verify.
- d is not reconstructed since this would reveal ⁇ and the factorization of N.
- Q(z) is the sum of up to n sharing polynomials Q i (z) with dealer P i .
- the problem that arises is that all parties should arrive at the same Q(z).
- agreement on faulty parties P j who did not properly share a polynomial is immediately available.
- the leader In the asynchronous system, this is not the case, so a single party is used, the leader, to choose a set S of parties whose sharings should be combined; this works because of the assumption that the leader is correct.
- Q(z) is set to ⁇ i ⁇ S Q i (z), and R(z) and H(z) are computed in the same way.
- This section relates to the complete protocol 30 for distributed computation of an RSA inverse value y, also referred to as complete protocol 30 , which is also robust, i.e., tolerates Byzantine faults.
- the complete protocol 30 comprises the preliminary protocol 20 for RSA inversion with non-faulty leader device.
- the preliminary protocol 20 is designed to be robust, still under the assumption that P i is honest.
- the AVSS sub-protocol yields a commitment vector C to its sharing polynomial.
- C S denote such a commitment to the polynomial used to share ⁇ , corresponding to the share S i of P i , and assume C S is made available initially to every party.
- C Qj , C Rj and C Hj for j ⁇ [1, n] denote the commitments resulting from the weak AVSS sub-protocols invoked by the preliminary protocol 20 .
- the weak AVSS sub-protocol is already robust and the message may remain unchanged. However, additional steps are used in the inversion protocol to prevent honest parties receiving sum-share value F and inverse-share value y P with incorrect data. Since these are point-to-point messages, the standard two-party techniques for proving statements about relations modulo a composite N are sufficient; this works under the strong RSA assumption.
- the preliminary protocol 20 is run t+1 times in parallel with different leaders, which guarantees that at least one leader is honest and the corresponding protocol terminates.
- a party terminates the first parallel protocol instance with the correct result it sends the result to all other parties, aborts the remaining instances, and halts. Every party who receives the correct result like this also aborts all inversion protocols. Note that every party may verify that a claimed result y is correct by checking that y e ⁇ x (mod N).
- Random oracles are a heuristic tool to analyze the security of cryptographic primitives by pretending that a hash function is implemented by a distributed oracle, which answers with a random value for every distinct point on which it is queried. They are used because the cryptographic systems in this model are typically more efficient than the corresponding systems in the standard model, where proofs must be based only on intractability assumptions.
- the public key contains the safe RSA modulus N
- the signature generation comprises the computation of an RSA inverse of a value x and a value e that are derived from the public key, from the message to be signed, and from random choice.
- Party P S serves as a gateway for signature requests from clients and starts the instance of the distributed signature protocol.
- Party P S is assumed to be honest and not to crash.
- both signature schemes are deterministic apart from the initial choice of one random value, and the only distributed computation is the RSA inversion.
- a possible protocol for asynchronous RSA threshold signatures proceeds as follows.
- the parties compute a random value using the standard approach: Every party shares a random secret using AVSS, the distinguished party P S announces a subset S of t+1 parties whose sharings have terminated successfully, all parties together reconstruct the secrets indicated by S, and every party adds the reconstructed secrets. The result is the desired random value, which is needed in both signature schemes.
- the parties carry out the complete protocol 30 for RSA inversion.
- every party computes the signature and outputs it.
- a verifiable random function is a pseudo-random function that provides a non-inter-actively verifiable proof for the correctness of its output.
- a pseudo-random functions ⁇ s with a secret seed s maps ⁇ -bit strings to ⁇ -bit strings; its output is computationally indistinguishable from a random function for any polynomial-time observer.
- a difficulty is that the proof should not reveal anything about ⁇ s on inputs different from x.
- a VRF construction is based on the unpredictability of the RSA inversion operation, but the construction is too complex to describe here.
- the RSA inversion step In order to obtain a threshold verifiable random function in asynchronous networks, only the RSA inversion step should be distributed; all other operations are deterministic, given the public key and the shared initialization data of the scheme.
- the complete protocol 30 for RSA inversion yields the first threshold VRF based on RSA, the strong RSA assumption, to be precise, which is also efficient, i.e., not based on generic multi-party computation methods.
- the VRF construction executes a sequence of RSA inversions; the asynchronous distributed implementation succeeds without using a Byzantine agreement primitive since every inversion operation is self-verifiable, as is the final VRF output.
- VRF asynchronous Byzantine agreement by using the VRF as a common coin sub-protocol.
- the inversion protocol yields also an efficient cryptographic asynchronous Byzantine agreement protocol under the strong RSA assumption, and without random oracles.
- Asynchronous Byzantine agreement protocols rely on randomization, which can be implemented by the mentioned common coin protocols.
- modem cryptography such a common coin is known as an unpredictable threshold pseudo-random function. So far, all efficient implementations of this primitive have relied on the random oracle model or on synchronous networks and broadcast channels.
- the present invention can be realized in hardware, software, or a combination of hardware and software. Any kind of computer system—or other apparatus adapted for carrying out the method described herein—is suited.
- a typical combination of hardware and software could be a general purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein.
- the present invention can also be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which—when loaded in a computer system—is able to carry out these methods.
- Computer program means or computer program in the present context mean any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following a) conversion to another language, code or notation; b) reproduction in a different material form.
Landscapes
- Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Detection And Prevention Of Errors In Transmission (AREA)
Abstract
The present invention discloses a method and system for distributed computation of an RSA inverse in an asynchronous network among participating network devices. The RSA inversion is self-verifiable and the result can be checked by every participating network device locally.
Description
The present invention is related to a method and system for distributed computation of an RSA inverse value in an asynchronous network among participating network devices.
RSA is the most widely used public-key cryptographic system today and uses an algorithm developed in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman. Methods for sharing an RSA key among a group of parties in a distributed system, and for using the key in a fault-tolerant way have therefore received considerable attention. They are the subject of threshold cryptography.
For example, it is well-known how to distribute an RSA signature scheme in synchronous networks among n parties such that a majority of them can securely issue signatures together, despite the fact that up to t may be faulty and misbehave in arbitrary, malicious ways. Given an RSA public key (N, e), where N is the product of two large primes, such schemes work by sharing the RSA “decryption exponent” d=e−1 mod φ(N) among the parties, where φ(•) is the Euler function. To sign m, the parties jointly compute σ such that σe≡m (mod N). The values N, e, and d are chosen when the signature scheme is set up and remain unchanged afterwards.
Several RSA-based cryptosystems have been proposed, where e is given dynamically together with a value x, and the problem is to compute y such that ye≡x (mod N). This is also referred to as the RSA inversion problem. Catalano, Gennaro, and Halevi present in “Computing inverses over a shared secret moduls,” in Advances in Cryptology: EUROCRYPT 2000 (B. Preneel, ed.), vol. 1087 of Lecture Notes in Computer Science, pp. 190-206, Springer, 2000, a protocol that solves the problem in the threshold setting for synchronous networks. This protocol computes d as the modular inverse of e with the shared modulus φ(N), from which y=xd mod N is obtained.
Most threshold cryptographic protocols assume a synchronous network with a broadcast channel connecting all parties. Although this assumption is justified in principle by the existence of suitable clock synchronization and Byzantine agreement protocols that provide broadcast, the approach leads to rather expensive solutions in practice, for example, when deployed in wide-area distributed systems with only loosely synchronized clocks. These systems are also vulnerable to timing attacks.
Almost all known threshold RSA schemes require a synchronous network with broadcast; the only exception is a non-interactive signature scheme by V. Shoup, “Practical threshold signatures,” in Advances in Cryptology: EUROCRYPT 2000 (B. Preneel, ed.), vol. 1087 of Lecture Notes in Computer Science, pp. 207-220, Springer, 2000, which however makes crucial use of the random oracle model.
From the above it follows that there is still a need in the art for an improved computing of an RSA inverse in asynchronous distributed systems, consisting of n communicating parties linked only by point-to-point channels, where local clocks are not synchronized and no a priori bound on message delay exists. A practical and efficient asynchronous distributed RSA inversion scheme is therefore desired.
Disclosed is an efficient asynchronous scheme which allows to compute an RSA inverse y with respect to a public RSA modulus N whose factorization is secret and shared among a group of parties, herein also referred to as participating network devices. Given two input values x and e, the scheme computes y such that ye≡x (mod N). The disclosed scheme is attractive because it does not rely on Byzantine agreement; it leads to efficient asynchronous protocols for threshold signatures and for Byzantine agreement based on the strong RSA assumption, without the use of random oracles. The random oracle model allows to design practical cryptographic systems, but only yields heuristic evidence for their security. Using the scheme, one can obtain asynchronous threshold implementations of the RSA signature schemes which are based on the strong RSA assumption. These represent the first implementations of threshold signatures in asynchronous networks without random oracles.
The disclosed scheme for asynchronous distributed RSA inversion is quite practical, achieves resilience n>4t, and uses O (n3) messages and O (n3 K2) communication, where K is a security parameter. Moreover, it is deterministic and does not rely on a randomized Byzantine agreement primitive, which would not only be more expensive but also preclude one of its applications: to implement randomized asynchronous Byzantine agreement using cryptography.
The scheme employs one distributed multiplication step like the synchronous RSA inversion protocol of Catalano et al. However, contrary to the generic approach of turning synchronous protocols with broadcast into asynchronous ones, the disclosed scheme does not need Byzantine agreement because RSA inversion is self-verifiable and the result can be checked by every participant, i.e. participating network device, locally.
In accordance with the present invention, there is provided a method for distributed computation of an RSA inverse value y in an asynchronous network from at least two input values x, e among n−1 participating network devices A, B, C comprising t<n/4 faulty devices and a non-faulty leader device D, the participating network devices A, B, C, D holding share values φA, φB, φC, φD of the Euler function φ(N) of an RSA modulus N, each participating network device, with P=A, B, C, D performing the steps of:
-
- (I) choosing a first random value q and a second random value r;
- (II) sharing over integers the first random value q, the second random value r, and the zero
value 0; - (III) the leader device D performing additionally the steps (i, ii) of:
- (i) receiving a first, second, and third sub-share value qi, ri, 0i from at least t+1 participating network devices A, B, C, D;
- (ii) broadcasting the identities S of said participating network devices A, B, C;
- (IV) receiving the identities S and corresponding sub-share values qi, ri, 0i;
- (V) deriving a sum-share value F from the share value φP, the at least one input value e, and the corresponding sub-share values qi, ri, 0i defined by the identities S,
- (VI) broadcasting the sum-share value F;
- (VII) receiving 2t+1 sum-share values Fi;
- (VIII) deriving a polynomial ƒ interpolating the sum-share values Fi and an exponent share value dP dependent on the polynomial ƒ, and an inverse-share value yP dependent on the exponent share value dP and the RSA modulus N;
- (IX) broadcasting the inverse-share value yP;
- (X) receiving t+1 inverse-share value yi; and
- (XI) obtaining the RSA inverse value y from the received inverse-share value yi.
Further, at least t+1 participating network devices A, B, C, D can act as a leader device while performing n times the above mentioned steps. Among the n participating network devices A, B, C, D there are t<n/4 faulty devices assumed. By doing so no correct leader is necessary.
Each participating network device A, B, C, D can perform the following steps. In the event of obtaining or receiving one RSA inverse value y, the validity of the obtained RSA inverse value y under use of the at least two input values x, e can be determined, and in the event of positive determination, the RSA inverse value y is broadcast and further calculations are stopped. This allows an efficient execution of the method while a termination can be guaranteed.
The sharing over integers can use a threshold signature for determining the consistency of subsequently received sub-share values qi, ri, 0i allows a faster termination of the scheme.
The sharing over integers can use a vector of digital signatures for determining the consistency of subsequently received sub-share values qi, ri, 0i which also allows a faster termination of the scheme.
The Extended Euclidean Algorithm can be applied for deriving the exponent share value dP, which from the practical point of view is efficient.
The RSA inverse value y can be obtained from the received inverse-share value yi by using the Lagrange Interpolation Algorithm, which is efficient.
Preferred embodiments of the invention are described in detail below, by way of example only, with reference to the following schematic drawings.
The drawings are provided for illustrative purposes only.
The leader device D additionally receives a first, second, and third sub-share value qi, ri, 0i from the at least t+1 participating network devices A, B, C, D and broadcasts the identities S of the participating network devices A, B, C, D, as indicated by the boxes IIIi and IIIii.
In a receiving step, the identities S and corresponding sub-share values qi, ri, 0i are received as indicated with box IV. Then, a sum-share value F can be derived from the share value φP, the input value e, and the corresponding sub-share values qi, ri, 0i defined by the identities S, as indicated with box V. The sum-share value F is then broadcast, as indicated with box VI, whereby such a broadcast does not guarantee anything if the respective sender is faulty. Then, 2t+1 sum-share values Fi are received, as indicated with box VII. A polynomial ƒ is derived, as indicated with box VIII, which interpolates the sum-share values Fi and an exponent share value dP dependent on the polynomial ƒ, and an inverse-share value yP dependent on the exponent share value dP and the RSA modulus N. The inverse-share value yP is then broadcast, as indicated with box IX, and t+1 inverse-share value yi are received as indicated with box X. Finally, the RSA inverse value y can be obtained from the received inverse-share value yi, as indicated with box XI.
In the event of positive determination the RSA inverse value y is broadcast, as indicated with box XIII, and all further calculations are stopped, as indicated with box XIV. This allows a termination of the protocol.
In order to facilitate the above-described steps some mathematical aspects are addressed in more detail below.
Cryptographic Assumptions
An RSA modulus N is the product of two primes of equal length. A safe prime π is a prime such that π−1/2 is prime. A safe RSA modulus N is the product of two safe primes π and Q, which comprise the secret key. The RSA operation is to compute me for given m and e. The RSA inversion operation is to compute an RSA inverse value y such that ye=x mod N for given x and e; y is also called the RSA inverse of x and e.
Given a secret key φ(N)=(π−1)(Q−1), RSA inversion is easily carried out by computing d=e−1 mod φ(N) and then raising x to the power d modulo N. The knowledge of φ(N) is equivalent to knowing the factorization of N. In the following it is shown how to compute this in an asynchronous distributed network where φ(N) is shared among the participating network devices A, B, C, D, hereafter also referred to as parties or P1, P2, . . . , Pn, or each as party or Pi, or Pl.
Computing RSA Inverses with a Shared Secret Key
A (n, k)-sharing of a secret φ is an encoding of s into a set of shares φA, φB, φC, φD such that any set of at least k shares uniquely defines φ and any set of less than k shares does not give information about φ. Associated with a sharing is an efficient reconstruction algorithm that reconstructs π from any set of k shares.
It is assumed that N is an RSA modulus. Suppose the participating network devices A, B, C, D, hold the shares of a (n, k)-sharing, as described in the previous paragraph, of the corresponding RSA secret key φ(N). The method 20 is hereafter also referred to as preliminary protocol 20, as there are messages sent forth and back between the parties. More precisely, the preliminary protocol 20 is an RSA inversion protocol with non-faulty leader device. The preliminary protocol 20 for RSA inversion of x and e, for some e>n, is started with input values e, N, x, φP. One party terminates the protocol by generating an output value y. All non-faulty parties should be activated like this and all should output y such that ye≡x (mod N).
The preliminary protocol 20 for RSA inversion over N with a shared secret key φ(N) as described above satisfies the following conditions for any adversary and up to t faulty parties:
Termination: If all honest parties start the protocol all messages are delivered, then all honest parties eventually terminate the protocol.
Correctness: If an honest party terminates the protocol and outputs y, then ye≡x (mod N) except with negligible probability.
Privacy: The adversary gains no useful information about φ(N).
Weak Asynchronous Verifiable Secret Sharing
In weak asynchronous verifiable secret sharing, the agreement property of standard asynchronous verifiable secret sharing (AVSS) is relaxed as follows. When the dealer is faulty, some honest parties may terminate a weak AVSS protocol and others may not, but those who terminate hold consistent shares and are guaranteed that there are enough honest parties holding shares in order to reconstruct the secret. In contrast, AVSS guarantees that either all honest parties terminate the protocol successfully or none, which ensures agreement on the success of the sharing. This difference is analogous to the difference between consistent broadcast and reliable broadcast in asynchronous networks. An AVSS protocol is provided in the International Publication WO 02/087145 A1, entitled “Method of verifiably sharing a secret in potentially asynchronous networks”, presently assigned to the assignee of the instant application and the disclosure of which is incorporated herein by reference.
The AVSS protocol is used many times as sub-protocol within the herein described RSA inversion protocol.
Dual-threshold sharings are considered in this paragraph, which generalize the standard notion of secret sharing by allowing the reconstruction threshold to exceed the number of corrupted parties by more than one. In an (n, k, t) dual-threshold sharing, there are n parties holding shares of a secret, of which up to t may be corrupted by an adversary, and any group of k or more honest parties may reconstruct the secret (n−t≧k>t). Such dual-threshold sharings are useful for distributed computation and agreement problems.
Polynomial secret sharing is usually done in a finite field, but it works also over , provided that extra randomization is added. This is a well-known technique developed in the context of threshold RSA. Let L=n!. To share a secret sε[0, M−1] over with security parameter K, choose k−1 random values F1, . . . , Fk−1 in [−KL2M, KL2M] and let ƒ(z)=L(Ls+Σi=1 k−1Fizi). Denote the coefficients of the sharing polynomial ƒ by ƒ0, ƒ1, . . . , ƒk−1; they are divisible by L and their absolute value is bounded by KL3M.
In the preliminary protocol 20, the shared secret is the first random value q with k=t+1 and M=K N and the second random value r with k=t+1 and M=K2N2, and the zero value 0 with k=2t+1 and M=K4L3N2.
The share of Pi is ƒ(i) for i=1, . . . , n computed in . It is easy to see that these values form a (n, k)-sharing because Ls=ΣiεSλi Sƒ(i) for any S⊂{1, . . . , n} of cardinality k, where λi S=ΠjεS\{i}−j/i−j are the Lagrange interpolation coefficients for S and position 0. This can be computed in because every ΠjεS\{i}(i−j) divides i! (n−i)!, which divides n!=L.
A protocol for weak AVSS comprises a secret sharing method with verification over the integers to achieve robustness based on the strong RSA assumption in N.
Let K be a security parameter, N a safe RSA modulus, g and h two random squares in *N and sε[0, M−1] the secret to share.
The dealer of the weak AVSS protocol first computes (n, k, t)-sharings of s and of a random s0ε M over the integers, defining two sharing polynomials ƒ and ƒ′, respectively. It also computes verification values Cj=gƒ j hƒ′ j mod N for j=0, . . . , k−1, where ƒj and ƒ′j denote the coefficients of ƒ and ƒ′.
The communication follows the approach of “echo broadcast”, also referred to as “consistent broadcast”, with a non-interactive (n, m, t) threshold signature scheme for m=max{k, n+t+1/2}. Recall that such a signature scheme tolerates up to t corrupted parties and requires m valid signature shares for assembling the threshold signature. First, the dealer sends a share of the secret to all parties and every party answers with a threshold signature share if the share is valid. Then, upon receiving m threshold signature shares, the dealer computes the threshold signature and sends it to all parties. Finally, a party accepts the sharing when it has a valid share and receives a valid threshold signature.
The protocol for weak AVSS allows to share multiple secrets s, s′, . . . in parallel with the same dealer in sharings with reconstruction thresholds k, k′, . . . . All properties are satisfied if the reconstruction threshold m of the threshold signature scheme is set to m=max {k, k′, . . . , n+t+1/2}. This not only decreases message and computation complexities compared to separate executions of the sharing protocol, but ensures also that every honest party holding a share of s holds also a share of s′, . . . .
The RSA Inversion Protocol with Non-Faulty Leader
The preliminary protocol 20 is contemplated to work with a correct leader. It tolerates crashes and a passive adversary. That is, all parties apart from the leader may crash and collude to gain knowledge about the secret, but otherwise they follow the protocol. The preliminary protocol 20 uses the approach of the synchronous protocol for computing modular inverses by Catalano et al., to obtain a sharing of d=e−1 mod φ(N). Given the shared d, the result y=xd mod N can be reconstructed.
The preliminary protocol 20 is hereafter described more mathematically. The input of every Pi includes e, N, x, and, φi where φi is Pi's share of φ=φ(N) in a (n, t+1, t)-sharing over N, using a polynomial S(z)=L(Lφ+Σj=1 tajzj) for aj←R [−KL2N, KL2N]. Let N≧K≧L2 and K>e>n.
The parties first compute a K-random (n, t+1, t)-sharing of a random Q0ε[0, KN−1], an analogous sharing of a random R0ε[0, K2N2−1], and a K-random (n, 2t+1, t)-sharing of 0ε[0, K4L3N2−1]. These sharings are executed in parallel as mentioned above in the protocol to share multiple secrets and define integer polynomials Q(z) and R(z) of degree t and H(z) of degree 2t. The shares of Pi are Q(i), R(i), and H(i).
Next, the parties obtain a sharing of F(0) for F(z)=S(z)Q(z)+eR(z)+H(z) by local multiplication and addition of shares only, and collaboratively reconstruct F(0)=L4φQ0+L2eR0. Every party applies the extended Euclidean algorithm to compute locally a and b such that aF(0)+be=1, which works if gcd(F(0), e)=1. Then, d=aL2R0+b is the inverse of e modulo φ, as is easy to verify. However, d is not reconstructed since this would reveal φ and the factorization of N. Instead, Pi computes a share of d as di=aL2R(i)+b using its share of R0; then it reveals yi=xd i . From t+1 such yi, the result y≡xd (mod N) can be recovered.
So far the description parallels the work of Catalano et. al., but the difference is in the computation of the sharings. Q(z) is the sum of up to n sharing polynomials Qi(z) with dealer Pi. The problem that arises is that all parties should arrive at the same Q(z). In the synchronous model with broadcast, agreement on faulty parties Pj who did not properly share a polynomial is immediately available. In the asynchronous system, this is not the case, so a single party is used, the leader, to choose a set S of parties whose sharings should be combined; this works because of the assumption that the leader is correct. Thus, Q(z) is set to ΣiεS Qi(z), and R(z) and H(z) are computed in the same way.
The RSA Inversion Protocol
This section relates to the complete protocol 30 for distributed computation of an RSA inverse value y, also referred to as complete protocol 30, which is also robust, i.e., tolerates Byzantine faults. The complete protocol 30 comprises the preliminary protocol 20 for RSA inversion with non-faulty leader device.
The preliminary protocol 20 is designed to be robust, still under the assumption that Pi is honest. The AVSS sub-protocol yields a commitment vector C to its sharing polynomial. Let CS denote such a commitment to the polynomial used to share φ, corresponding to the share Si of Pi, and assume CS is made available initially to every party. Let CQj, CRj and CHj for jε[1, n] denote the commitments resulting from the weak AVSS sub-protocols invoked by the preliminary protocol 20.
The weak AVSS sub-protocol is already robust and the message may remain unchanged. However, additional steps are used in the inversion protocol to prevent honest parties receiving sum-share value F and inverse-share value yP with incorrect data. Since these are point-to-point messages, the standard two-party techniques for proving statements about relations modulo a composite N are sufficient; this works under the strong RSA assumption.
-
- For the message comprising the sum-share value F, the sender P carries out a zero-knowledge proof of knowledge with every receiver that F has been computed correctly with respect to CS, CQj, CRj, and CHj for jεS. The receiver receives the message only if the proof is correct.
- For the message comprising inverse-share value yP, the sender P carries out a zero-knowledge proof of knowledge with every receiver that yP has been computed correctly with respect to a, b, and CRj for jεS (the receiver uses its own values a and b computed upon receiving messages). The receiver accepts the message only if the proof is correct.
It remains to show how to cope with a corrupted leader Pl. For that, the preliminary protocol 20 is run t+1 times in parallel with different leaders, which guarantees that at least one leader is honest and the corresponding protocol terminates. As soon as a party terminates the first parallel protocol instance with the correct result, it sends the result to all other parties, aborts the remaining instances, and halts. Every party who receives the correct result like this also aborts all inversion protocols. Note that every party may verify that a claimed result y is correct by checking that ye≡x (mod N).
This works because the RSA inversion operation is deterministic and the result is self-verifiable; thus, all protocol copies output the same result for all parties and every party can check locally that the output is correct if they receive the result from another party.
Application: Threshold RSA Signatures
Standard RSA signatures can be proved secure only in the random oracle model. Random oracles are a heuristic tool to analyze the security of cryptographic primitives by pretending that a hash function is implemented by a distributed oracle, which answers with a random value for every distinct point on which it is queried. They are used because the cryptographic systems in this model are typically more efficient than the corresponding systems in the standard model, where proofs must be based only on intractability assumptions.
Two related RSA signature schemes that avoid the random oracle model have been proposed recently. One was presented by R. Gennaro, S. Halevi, and T. Rabin in their article “Secure hash-and-sign signatures without the random oracle,” in Advances in Cryptology: EUROCRYPT '99 (J. Stem, ed.), vol. 1592 of Lecture Notes in Computer Science, Springer, 1999, and the second one by R. Cramer and V. Shoup presented in the article “Signature schemes based on the strong RSA problem,” ACM Transactions on Information and System Security, vol. 3, no. 3, pp. 161-185, 2000.
Both rely on the “strong RSA assumption” and involve the RSA-inversion of an element x with a fresh e for every signature. These schemes can be implemented in a distributed system using threshold cryptography by sharing φ(N) and carrying out a distributed RSA inversion protocol, as shown by Catalano et al. for synchronous systems.
In both schemes, the public key contains the safe RSA modulus N, and the signature generation comprises the computation of an RSA inverse of a value x and a value e that are derived from the public key, from the message to be signed, and from random choice. Using the complete protocol 30, the first efficient implementations of RSA threshold signatures in asynchronous networks works as follows.
Suppose there is a distinguished party PS who serves as a gateway for signature requests from clients and starts the instance of the distributed signature protocol. Party PS is assumed to be honest and not to crash. Given the message, both signature schemes are deterministic apart from the initial choice of one random value, and the only distributed computation is the RSA inversion.
Thus, a possible protocol for asynchronous RSA threshold signatures proceeds as follows. First, the parties compute a random value using the standard approach: Every party shares a random secret using AVSS, the distinguished party PS announces a subset S of t+1 parties whose sharings have terminated successfully, all parties together reconstruct the secrets indicated by S, and every party adds the reconstructed secrets. The result is the desired random value, which is needed in both signature schemes. Second, the parties carry out the complete protocol 30 for RSA inversion. Finally, every party computes the signature and outputs it.
In absence of an honest PS, the sketched protocol is run t+1 times in parallel; this may result in up to t+1 different signatures on the same message, which is unlikely to cause problems in most applications.
Application: Verifiable Random Functions and Byzantine Agreement
A verifiable random function (VRF) is a pseudo-random function that provides a non-inter-actively verifiable proof for the correctness of its output. A pseudo-random functions ƒs with a secret seed s maps κ-bit strings to λ-bit strings; its output is computationally indistinguishable from a random function for any polynomial-time observer. S. Micali, M. Rabin, and S. Vadhan in “Verifiable random functions,” in Proc. 40th IEEE Symposium on Foundations of Computer Science (FOCS), 1999, formalized the notion of a verifiable random function: given an input and knowledge of the seed s allows to compute v together with a unique verification value or “proof”. This proof convinces every verifier of the fact that v with respect to the given public key of the VRF. A difficulty is that the proof should not reveal anything about ƒs on inputs different from x.
A VRF construction is based on the unpredictability of the RSA inversion operation, but the construction is too complex to describe here. In order to obtain a threshold verifiable random function in asynchronous networks, only the RSA inversion step should be distributed; all other operations are deterministic, given the public key and the shared initialization data of the scheme.
The complete protocol 30 for RSA inversion yields the first threshold VRF based on RSA, the strong RSA assumption, to be precise, which is also efficient, i.e., not based on generic multi-party computation methods. The VRF construction executes a sequence of RSA inversions; the asynchronous distributed implementation succeeds without using a Byzantine agreement primitive since every inversion operation is self-verifiable, as is the final VRF output.
An interesting application of this threshold VRF is to implement asynchronous Byzantine agreement by using the VRF as a common coin sub-protocol. Thus, the inversion protocol yields also an efficient cryptographic asynchronous Byzantine agreement protocol under the strong RSA assumption, and without random oracles.
Asynchronous Byzantine agreement protocols rely on randomization, which can be implemented by the mentioned common coin protocols. In modem cryptography, such a common coin is known as an unpredictable threshold pseudo-random function. So far, all efficient implementations of this primitive have relied on the random oracle model or on synchronous networks and broadcast channels.
Any disclosed embodiment may be combined with one or several of the other embodiments shown and/or described. This is also possible for one or more features of the embodiments.
The present invention can be realized in hardware, software, or a combination of hardware and software. Any kind of computer system—or other apparatus adapted for carrying out the method described herein—is suited. A typical combination of hardware and software could be a general purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein. The present invention can also be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which—when loaded in a computer system—is able to carry out these methods.
Computer program means or computer program in the present context mean any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following a) conversion to another language, code or notation; b) reproduction in a different material form.
Claims (7)
1. A method for distributed computation of an RSA inverse value (y) for asynchronous authentication for communication of encrypted messages in an asynchronous network for at least two input values (x, e) among n−1 participating network devices compromising t<n/4 faulty devices and a non-faulty leader device, the participating network devices holding share values of the Euler function (μ(N)) of RSA modulus (N), each participating network device performing the steps of:
a. choosing a first random value (q) and a second random value (r);
b. sharing over integers (Z) the first random value (q), the second random value (r), and the zero value (0);
c. the leader device performing additionally the steps of:
i. receiving a first, second, and third sub-share value (qi, ri, 0i,) from at least t+1 participating network devices;
ii. broadcasting identities of said participating network devices;
d. receiving the identities and corresponding sub-share values (qi, ri, 0i,);
e. deriving a sum-share value (F) from one of the sub-share values, the at least one input value (e), and the corresponding first, second and third sub-share values (qi, ri, 0i,) defined by the identities;
f. broadcasting the sum-share values (F);
g. receiving 2t+1 sum-share values (Fi);
h. deriving a polynomial (ƒ) interpolating the sum-share values (Fi) and an exponent share value (dp) dependent on the polynomial (ƒ), and an inverse-share value (yp) dependent on the exponent share value (dp) and the RSA modulus (N);
i. broadcasting the inverse-share value (yp);
j. receiving t+1 inverse share values (yi);
k. verifying the validity of the received values for authenticating participating network devices by obtaining the RSA inverse value (y) from the received inverse-share values (yi), determining the validity of the obtained RSA inverse value (y) using at least two input values (x, e,), and, in the event of a positive determination, broadcasting the RSA inverse value (y), and stopping further calculations; and
l. applying the derived exponent share values for encryption of communications with authenticated participating network devices.
2. A method according to claim 1 to compute the RSA inverse value (y), wherein among n participating network devices (A, B, C, D) compromising t<n/4 faulty devise at least t+1 participating network devices (A, B, C, D) act as a leader device while performing n times the steps of claim 1 .
3. A method according to claim 1 , wherein the step (b) of sharing over integers (Z) comprises using a threshold signature for determining the consistency of subsequently received sub-share values (qi, ri, 0i).
4. A method according to claim 1 , wherein step (b) of sharing over integers (Z) comprises using a vector of digital signatures for determining the consistency of subsequently received sub-share values (qi, ri, 0i).
5. A method according to claim 1 , wherein step (h) of deriving an exponent share value (dp) comprises using the Extended Euclidean Algorithm.
6. A method according to claim 1 , wherein the step (k) of obtaining the RSA inverse value (y) from the received inverse-share value (yi) comprises using the Lagrange Interpolation Algorithm.
7. A plurality of program storage devices, each readable by at least one digital processing apparatus and having a program of instructions which are tangibly embodied in the storage devices and which are executable by at least one processing apparatus to perform a method for distributed computations of an RSA inverse value (y), for asynchronous authentication for communication of encrypted messages in an asynchronous network from at least two input values (x, e) among n−1 participating network devices (A, B, C, D) holding share values (μA, μB, μC, μD) of the Euler function (μ(N)) of an RSA modulus (N), said program allowing each participating network to perform the following steps:
a. choosing a first random value (q) and a second random value (r);
b. sharing over integers (Z) the first random value (q), the second random value (r), the zero value (0);
c. the leader device (D) performing additionally the steps of:
i. receiving a first, second, and third sub-share value (qi, ri, 0i) from at least t+1 participating network devices;
ii. broadcasting identities (S) of said participating network devices
d. receiving the identities (S) and corresponding sub-share values (qi, ri, 0i);
e. deriving a sum-share value (F) from the sub-share value (p), the at least one input value (e), and the corresponding sub-share values (qi, ri, 0i) defined by the identities (S),
f. broadcasting the sum-share value (F);
g. receiving 2t+1 sum-share values (Fi);
h. deriving a polynomial (ƒ) interpolating the sum-share values (Fi) and an exponent share value (dp) dependent on the polynomial (ƒ) and an inverse-share value (yp) dependent on the exponent share value (dp) and the RSA modulus (N);
i. broadcasting the inverse-share value (yp);
j. receiving t+1 inverse-share values (yi);
k. verifying the validity of the received values for authenticating participating network devices by obtaining the RSA inverse value (y) from the received inverse-share values (yi), determining the validity of the obtained RSA inverse value (y) using at least two input values (x, e,), and, in the event of a positive determination, broadcasting the RSA inverse value (y), and stopping further calculations; and
l. applying the derived exponent share values for encryption of communications with authenticated participating network devices.
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP03405040.1 | 2003-01-29 | ||
EP03405040 | 2003-01-29 |
Publications (2)
Publication Number | Publication Date |
---|---|
US20040254967A1 US20040254967A1 (en) | 2004-12-16 |
US7327847B2 true US7327847B2 (en) | 2008-02-05 |
Family
ID=33495663
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/768,933 Expired - Fee Related US7327847B2 (en) | 2003-01-29 | 2004-01-30 | Method for distributed computation of RSA inverses in asynchronous networks |
Country Status (1)
Country | Link |
---|---|
US (1) | US7327847B2 (en) |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9449177B1 (en) * | 2013-03-13 | 2016-09-20 | Hrl Laboratories, Llc | General protocol for proactively secure computation |
US9467451B1 (en) | 2013-03-13 | 2016-10-11 | Hrl Laboratories, Llc | Generic proactively-secure secret-sharing protocol from any suitable honest-majority secret-sharing protocol |
US9536114B1 (en) | 2013-03-13 | 2017-01-03 | Hrl Laboratories, Llc | Secure mobile proactive multiparty computation protocol |
US9614676B1 (en) | 2013-03-13 | 2017-04-04 | Hrl Laboratories, Llc | Cryptographically-secure packed proactive secret sharing (PPSS) protocol |
US10630477B1 (en) * | 2018-12-27 | 2020-04-21 | Blue Helix | Efficient threshold distributed elliptic curve key generation and signature method and system |
US11063743B2 (en) * | 2017-03-21 | 2021-07-13 | Thales Dis France Sa | Method of RSA signature of decryption protected using assymetric multiplicative splitting |
Families Citing this family (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6957331B2 (en) * | 2000-01-14 | 2005-10-18 | International Business Machines Corporation | Method of achieving multiple processor agreement in asynchronous networks |
US6931431B2 (en) * | 2001-01-13 | 2005-08-16 | International Business Machines Corporation | Agreement and atomic broadcast in asynchronous networks |
JP3910538B2 (en) * | 2001-03-16 | 2007-04-25 | インターナショナル・ビジネス・マシーンズ・コーポレーション | How to share a secret verifiably in a potentially asynchronous network |
JP4699099B2 (en) * | 2005-06-14 | 2011-06-08 | 富士通株式会社 | Communication control device and communication control method |
US9455992B2 (en) * | 2009-06-12 | 2016-09-27 | Microsoft Technology Licensing, Llc | Trusted hardware component for distributed systems |
US10572352B2 (en) * | 2017-11-01 | 2020-02-25 | Vmware, Inc. | Byzantine fault tolerance with verifiable secret sharing at constant overhead |
US10447475B1 (en) * | 2018-11-08 | 2019-10-15 | Bar Ilan University | System and method for managing backup of cryptographic keys |
LT3683678T (en) | 2019-01-15 | 2023-02-10 | Iov42 Limited | Computer-implemented method, computer program and data processing system |
CN114679280A (en) * | 2022-03-15 | 2022-06-28 | 北京宏思电子技术有限责任公司 | RSA-based joint signature generation method and device |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040117649A1 (en) * | 2001-04-27 | 2004-06-17 | William Whyte | System and method for processing a shared secret |
-
2004
- 2004-01-30 US US10/768,933 patent/US7327847B2/en not_active Expired - Fee Related
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040117649A1 (en) * | 2001-04-27 | 2004-06-17 | William Whyte | System and method for processing a shared secret |
Non-Patent Citations (1)
Title |
---|
Catalano et al., "Computing inverses over a shared secret moduls," in Advances in Cryptology: EUROCRYPT 2000 (B. Preneel, ed.), vol. 1087 of Lecture Notes in Computer Science, pp. 190-206, Springer, 2000. * |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9449177B1 (en) * | 2013-03-13 | 2016-09-20 | Hrl Laboratories, Llc | General protocol for proactively secure computation |
US9467451B1 (en) | 2013-03-13 | 2016-10-11 | Hrl Laboratories, Llc | Generic proactively-secure secret-sharing protocol from any suitable honest-majority secret-sharing protocol |
US9536114B1 (en) | 2013-03-13 | 2017-01-03 | Hrl Laboratories, Llc | Secure mobile proactive multiparty computation protocol |
US9614676B1 (en) | 2013-03-13 | 2017-04-04 | Hrl Laboratories, Llc | Cryptographically-secure packed proactive secret sharing (PPSS) protocol |
US11063743B2 (en) * | 2017-03-21 | 2021-07-13 | Thales Dis France Sa | Method of RSA signature of decryption protected using assymetric multiplicative splitting |
US10630477B1 (en) * | 2018-12-27 | 2020-04-21 | Blue Helix | Efficient threshold distributed elliptic curve key generation and signature method and system |
Also Published As
Publication number | Publication date |
---|---|
US20040254967A1 (en) | 2004-12-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10530585B2 (en) | Digital signing by utilizing multiple distinct signing keys, distributed between two parties | |
MacKenzie et al. | Password-authenticated key exchange based on RSA | |
Moore | Protocol failures in cryptosystems | |
Frankel et al. | Parallel reliable threshold multisignature | |
US6035041A (en) | Optimal-resilience, proactive, public-key cryptographic system and method | |
Hofheinz et al. | Practical chosen ciphertext secure encryption from factoring | |
MacKenzie et al. | Two-party generation of DSA signatures | |
US7796761B2 (en) | Distribution and authentication of public keys using random numbers and diffie-hellman public keys | |
Gennaro et al. | Robust and efficient sharing of RSA functions | |
Gennaro et al. | Secure applications of Pedersen’s distributed key generation protocol | |
Coron et al. | Universal padding schemes for RSA | |
US7327847B2 (en) | Method for distributed computation of RSA inverses in asynchronous networks | |
Michels et al. | Efficient convertible undeniable signature schemes | |
Chen et al. | Diogenes: lightweight scalable RSA modulus generation with a dishonest majority | |
Lindell | Simple three-round multiparty schnorr signing with full simulatability | |
US6122742A (en) | Auto-recoverable and auto-certifiable cryptosystem with unescrowed signing keys | |
US20030221102A1 (en) | Method and apparatus for performing multi-server threshold password-authenticated key exchange | |
Frankel et al. | Adaptively-secure distributed public-key systems | |
US20030229788A1 (en) | Method and apparatus for distributing shares of a password for use in multi-server password authentication | |
Frankel et al. | Adaptively-secure optimal-resilience proactive RSA | |
Pan et al. | Multi-signatures for ECDSA and Its Applications in Blockchain | |
University of Waterloo. Dept. of Combinatorics and Optimization et al. | Shared generation of shared RSA keys | |
Kaya et al. | Robust threshold schemes based on the Chinese remainder theorem | |
Kwon | Virtual software tokens-a practical way to secure PKI roaming | |
Kate et al. | Asynchronous distributed private-key generators for identity-based cryptography |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CACHIN, CHRISTIAN;REEL/FRAME:015029/0615 Effective date: 20040810 |
|
FPAY | Fee payment |
Year of fee payment: 4 |
|
REMI | Maintenance fee reminder mailed | ||
LAPS | Lapse for failure to pay maintenance fees | ||
STCH | Information on status: patent discontinuation |
Free format text: PATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362 |
|
FP | Lapsed due to failure to pay maintenance fee |
Effective date: 20160205 |